A deployed Claude API integration begins receiving unusual requests. Analysis reveals a pattern: requests start with benign context-setting, then gradually escalate through several turns to requests that violate content policies. Each individual turn appears borderline acceptable, but the cumulative trajectory clearly aims to elicit policy-violating content. What defense architecture addresses this multi-turn escalation pattern?

The correct defense is conversation-level safety analysis: maintain a risk score that accumulates across turns; detect escalation patterns (gradual policy boundary testing, context manipulation, persona override attempts) and trigger intervention when cumulative risk exceeds a threshold. Multi-turn escalation attacks exploit the gap between per-turn safety evaluation and conversation-level intent — each individual turn may pass per-turn filters while the sequence reveals a clear policy-circumvention intent. Conversation-level risk scoring that accumulates across turns can detect escalation patterns (repeated boundary testing, gradual persona manipulation) and intervene before the target request is reached. The final-turn-only content filtering approach is wrong because applying filtering only to the final turn is exactly the vulnerability being exploited — the attack works precisely because each early turn appears benign; analyzing only the final turn misses the manipulative trajectory. The block-all-multi-turn conversations approach is wrong because blocking all multi-turn conversations eliminates the conversational capability that makes Claude useful for complex tasks — legitimate multi-turn use cases (debugging, iterative writing, complex analysis) would be destroyed. The stricter per-turn content filtering thresholds approach is wrong because stricter per-turn thresholds increase false positives on legitimate borderline requests without addressing the escalation trajectory problem — the attack uses individually borderline turns precisely because they pass per-turn thresholds.